Flap and StonkFun say they have restored their websites after the DNS attack. Origami has restored DNS but still tells users to avoid its site and is keeping vaults paused while it awaits an explanation of the cause.
Security company Blockaid named 12 DeFi websites linked to the same attack in its October 31 warning. It first urged Flap and Kintsu users to avoid interacting with the sites or signing transactions. It then said ten additional domains were actively serving the StepDrainer wallet-draining software.
The expanded list named StonkFun, Pickle Finance, Echelon, Origami Finance, FluxBeam, StakePoint, SupSwap, Longbow, SHPRD and Apex DeFi. Blockaid said it was continuing to investigate and gather data. The company and project teams did not provide a final aggregate loss, victim count or attacker identity in the statements reviewed, or announce a shared reimbursement plan.
In the post below, Blockaid lists ten additional domains and quotes its first warning about Flap and Kintsu.
Blockaid’s warning about the affected DeFi websites
The post loads from X when you open it.
The correct domain can still lead to a fake site
In its initial statement, Flap said attackers had hijacked DNS for flap.sh and redirected visitors to an unauthorized website. DNS connects a domain name entered in a browser to the relevant server. If an attacker changes that mapping, a user can enter the correct address and still reach a fraudulent page.
Flap later said it was investigating whether its domain service provider was involved and had temporarily moved the service to flap.cool. Origami separately pointed to Vercel-associated nameservers. The teams have not yet explained how the attackers changed the DNS settings.
Taking over a website does not by itself establish that its on-chain smart contracts were compromised. An attacker can nevertheless use a fake interface to ask visitors to sign a transaction or message authorizing asset transfers. A user who approves a malicious request can lose assets from their wallet even if the contract code has no flaw. Blockaid’s list counts websites, not 12 compromised blockchains or a confirmed loss for every visitor.
Which services have reopened?
In its latest update, Flap said it had brought flap.sh back online and that the temporary flap.cool domain remained available. The team added that it was monitoring the situation closely.
| Service | Team’s statement |
|---|---|
| Flap | flap.sh is back online; the temporary flap.cool domain remains available. |
| StonkFun | The website was taken offline, moved to new infrastructure and restored. |
| Origami Finance | DNS is restored; vaults remain paused and users are still told to avoid the site. |
The StonkFun team said on-chain activity was running normally and that it was unaware of anyone affected by the attack. It asked users to wait before connecting because some networks could take up to an hour to receive the new DNS information. Its one-hour recommendation ran from that announcement; the team has not provided a confirmed victim count.
Origami continued to tell users not to access its site despite restoring DNS. The team said it was waiting for a root-cause analysis from Vercel and Name.com and would not reopen its vaults until it could be sure the attack path had been removed. Its initial warning said smart contracts and funds in its vaults were unaffected. It gave no firm time for reopening.
Disconnecting a wallet does not revoke approval
Wallet maker Tangem’s August 25, 2025 explanation describes how attackers copy legitimate interfaces and ask users for spending approvals or signatures. A token approval lets a specified address transfer a particular token up to an authorized amount. While an unlimited approval remains active, an attacker may also take more of that token arriving later. A user can sign a Permit message without sending an immediate on-chain transaction, allowing an attacker to submit the signature later to authorize spending. Simply connecting a wallet to a site does not grant that permission.
Tangem’s August 12, 2024 guide recommends disconnecting from a suspicious application and separately checking and revoking existing token approvals. On-chain spending permission can remain after the site is disconnected. Before signing, users need to check the authorized address, token and amount, and never enter a recovery phrase into a website. Revoking permission cannot reverse a completed transfer. An unused Permit signature may not appear in a standard approval list, so an empty list does not establish that every risk has ended.
Blockaid says its dApp scanning service opens websites in a controlled environment using mock wallets. It examines network requests and proposed transactions to identify malicious applications.
